AAIA Practice Questions

A Disaster Recovery Plan (DRP) is the foundational control for mitigating the impact of significant service disruptions. For an AI-based system, which has unique failure modes like model poisoning, catastrophic forgetting, or adversarial attacks, a generic DRP is insufficient. Including a range of specific AI disruption scenarios within the DRP ensures that the organization has pre-planned, tested, and resourced procedures to recover from worst-case events. This proactive and comprehensive planning is the most effective strategy for ensuring timely and orderly restoration of services, thereby minimizing business impact. It is more encompassing than reactive measures or testing activities alone.

A. Performing periodic tabletop exercises is a method to test and validate a plan. The plan itself is the primary mitigation control, not the exercise used to test it.

B. A kill chain or kill switch is a reactive containment mechanism. While critical, it is only one component of a full disaster recovery process, not the entire mitigation strategy.

C. Updating key risk indicators (KRIs) is a monitoring activity. KRIs provide early warnings of increasing risk but do not constitute a plan for recovering from an actual disruption.

1. ISACA

Auditing Artificial Intelligence

2023: Chapter 5

"AI Risk Management

" emphasizes the need to update business continuity and disaster recovery plans (BCP/DRP) to address unique AI-related risks. It states that traditional DRPs may not cover scenarios like model degradation or data poisoning

making it essential to explicitly include them.

2. NIST Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems

September 2010: Section 2.2

"Contingency Planning

" defines contingency planning as the development of "a formal plan that prepares organizations to respond to system disruptions." This establishes the DRP as the core control for managing disruptions.

3. NIST

AI Risk Management Framework (AI RMF 1.0)

January 2023: The "Govern" function (GOV 4.2) discusses establishing policies for AI system failures and incidents. The "Manage" function (MANAGE 2.3) covers identifying and documenting AI risks

which would inform the specific scenarios to be included in a DRP.

The greatest risk associated with using AI in audit planning is incomplete data. AI models are fundamentally data-driven; their ability to identify risks, patterns, and anomalies for audit planning depends entirely on the quality and completeness of the input data. If the data used to train or run the AI is incomplete, biased, or inaccurate, the resulting audit plan will be inherently flawed. This "Garbage In, Garbage Out" (GIGO) principle can lead auditors to focus on the wrong areas or, more critically, to miss significant risks, thereby undermining the entire audit's effectiveness and reliability.

A. Increased planning costs: While AI implementation has initial costs, it is often adopted to increase efficiency and reduce long-term costs. This financial risk is less severe than one that invalidates the audit's conclusions.

B. Scope creep: This is a project management risk. The audit team retains ultimate control over the audit scope and can manage suggestions from the AI, making this a controllable issue.

D. Limited knowledge: This is a consequence of incomplete data. The AI's "knowledge" is derived from its data; therefore, incomplete data is the more precise and foundational root cause of this risk.

1. ISACA. (2023). Auditing Artificial Intelligence. Section 3.2

"Data and AI Models." This section emphasizes that the quality of data is a primary determinant of an AI system's performance and reliability

stating

"The quality of the data used to train and test AI models is critical to their performance... Biased or incomplete data can lead to inaccurate or unfair outcomes."

2. Alles

M. G. (2015). "Drivers of the use and facilitators and obstacles of the evolution of big data by the audit profession." Accounting Horizons

29(2)

439-449. The paper discusses that a key obstacle for data analytics (a precursor to AI) in audit is the availability and quality of data

highlighting that "the main obstacles to the evolution of Big Data in the audit profession are data-related" (p. 444).

3. Yoon

K.

Hoogduin

L.

& Zhang

L. (2015). "Big Data as a Complement to Audit Evidence." Accounting Horizons

29(2)

431-438. The authors note that the utility of big data and associated analytics in auditing is contingent on the data's integrity. A lack of complete and reliable data poses a significant risk to the validity of any conclusions drawn.

The most reliable and objective method for an auditor to confirm the fairness of an AI model's decisions is by testing it with a curated sample dataset. This approach, a form of substantive testing, allows the auditor to use a controlled, representative, and specifically designed dataset to systematically evaluate the model's outputs for biases against protected attributes or subgroups. The results are quantifiable using established fairness metrics, providing direct, empirical, and repeatable evidence of the model's behavior. This is superior to indirect, subjective, or uncontrolled methods.

A. Analyzing system metadata: This provides contextual information about the model's lineage and training but does not directly test the fairness of its outputs on new data.

C. Interviewing developers: This is a form of inquiry that yields subjective information about intent and process, not objective, empirical evidence of the model's actual performance.

D. Observing the system’s interactions with end users: This method is uncontrolled and anecdotal; the observed data may not be sufficient or structured to systematically quantify fairness.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). NIST AI 100-1. In the "Measure" function

section 4.4

the framework emphasizes the use of "technical tests and evaluations" with "methodologically sound metrics" to assess AI system trustworthiness

including fairness and bias. Testing with a curated dataset is a primary example of such a technical test.

2. The Institute of Internal Auditors (IIA). (2020). Global Technology Audit Guide (GTAG): Auditing Artificial Intelligence. This guide highlights that a key audit step is to "Test for biased outcomes

" which involves "running test scenarios with different data sets to determine whether the AI is producing biased outcomes" (p. 18).

3. Koene

A.

et al. (2021). A Governance Framework for Algorithm Accountability. In M. D. B. B. C. D. L. F. G. H. J. K. L. M. N. O. P. R. S. T. U. V. W. Z. D. Leslie (Ed.)

The Oxford Handbook of AI Ethics. Oxford University Press. Chapter 18 discusses the necessity of "testing and validation" using specific datasets to audit algorithms for fairness and other ethical concerns

distinguishing it from procedural checks.

4. Mittelstadt

B. (2019). Principles alone cannot guarantee ethical AI. Nature Machine Intelligence

1

501–507. https://doi.org/10.1038/s42256-019-0114-4. The paper argues for technical and institutional solutions beyond principles

where "auditing" through empirical testing is a key mechanism to verify claims of fairness and non-discrimination in practice.

An AI model inventory is a centralized repository that catalogs all AI models within an organization. A comprehensive inventory documents critical information for each model, including its intended purpose, business owner, scope, and the specific business problem it addresses. This documentation provides the most direct and holistic evidence for an auditor or reviewer to assess how individual AI systems and the overall AI portfolio align with and support the organization's strategic business objectives. It serves as the foundational record linking technical assets to business value.

A. AI model vulnerability assessment: This report focuses on security weaknesses and potential exploits, which is a risk management function, not a measure of strategic business alignment.

B. AI change management requests: These document specific modifications to a model. While a change may be intended to improve alignment, the requests themselves are transactional and do not provide a complete picture.

D. AI acceptable use policy: This is a governance document that dictates how employees should use AI systems, rather than providing evidence of a specific model's purpose or its alignment with business goals.

1. ISACA. (2023). Auditing Artificial Intelligence. Page 21

"An inventory of AI systems is a foundational element of AI governance. The inventory should include key information about each system

such as its purpose

owner

data sources

and risk level... This allows the organization to have a clear view of its AI landscape and to manage it effectively."

2. National Institute of Standards and Technology (NIST). (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1. Page 14

Section 3.2

MAP Function. The framework emphasizes that "Mapping exercises begin with context-setting... This includes delineating the system’s intended purposes and objectives." An AI model inventory is the primary artifact that records this mapping.

3. Hupont

I.

et al. (2022). Towards Accountable AI: A Responsible-AI-by-Design Process and a Case Study. Proceedings of the 2022 AAAI/ACM Conference on AI

Ethics

and Society. Page 346. The paper discusses the importance of documenting the "intended purpose" of an AI system as a core component of accountability

which is captured within a model inventory. https://doi.org/10.1145/3531146.3533205

The core computational logic of most generative AI models is probabilistic, not deterministic. When given a prompt or a set of data, the model calculates a probability distribution over a vast range of possible next words or tokens. The final output is then generated by sampling from this distribution. Techniques like temperature scaling and nucleus sampling are used to control the randomness of this sampling process. Because the output is a result of probabilistic sampling, running the same query multiple times can produce different, yet plausible, results. An IS auditor must understand this inherent stochasticity to evaluate the model's consistency, reliability, and the associated risks for high-stakes applications like financial advice.

A. Limitations can arise in the quantification of risk profiles. This is a consequence of the model's variable output, not the fundamental reason for the variability itself.

B. Neural node access varies each time the process is executed. This is an inaccurate description of the inference process; the variability is primarily due to probabilistic sampling of the output, not random internal pathways.

D. Servers are reconfigured periodically. This is an operational infrastructure issue and is unrelated to the fundamental mathematical principles upon which the generative AI model operates.

1. Goodfellow

I.

Bengio

Y.

& Courville

A. (2016). Deep Learning. MIT Press. Chapter 3

"Probability and Information Theory

" establishes the probabilistic framework that underpins modern machine learning models

including generative AI.

2. Stanford University. (2023). CS224N: Natural Language Processing with Deep Learning

Lecture 11: Language Models and RNNs Part 2. This lecture explains that language models work by producing a probability distribution over the vocabulary for the next word

P(xt | x1

...

x{t-1})

and then sampling from this distribution to generate text. This sampling is the source of variability.

3. Holtzman

A.

Buys

J.

Du

L.

Forbes

M.

& Choi

Y. (2019). The Curious Case of Neural Text Degeneration. Proceedings of the International Conference on Learning Representations (ICLR). This paper details sampling strategies (e.g.

nucleus sampling) that are explicitly probabilistic and designed to control the randomness in text generation to produce higher-quality

non-deterministic outputs. (Available at: https://arxiv.org/abs/1904.09751)

In a predictive maintenance scenario like forecasting wind turbine failure, the cost of a False Negative (failing to predict an actual failure) is significantly higher than the cost of a False Positive (predicting a failure that does not occur). A missed failure could lead to catastrophic damage, extended downtime, and safety hazards. Recall, also known as Sensitivity or the True Positive Rate, measures the model's ability to identify all actual positive cases (TP / (TP + FN)). Therefore, maximizing recall is the primary objective to ensure as few actual failures as possible are missed, even if it means accepting more false alarms.

A. Precision: This metric (TP / (TP + FP)) focuses on minimizing false alarms. While important, it is secondary to the critical need to not miss an actual failure.

B. Specificity: This metric (TN / (TN + FP)) measures the model's ability to correctly identify non-failing turbines, which does not address the primary goal of catching failures.

C. Accuracy: This is often a misleading metric for imbalanced datasets, which are common in fault detection. A model could achieve high accuracy by simply always predicting the majority class (no failure).

1. Powers

D. M. W. (2011). Evaluation: From Precision

Recall and F-Measure to ROC

Informedness

Markedness & Correlation. Journal of Machine Learning Technologies

2(1)

37-63. (This paper provides a foundational overview of evaluation metrics

discussing the contexts where recall is prioritized over precision

such as in diagnostic tasks where missing a positive case is critical. See Section 2

"Precision and Recall").

2. Provost

F.

& Fawcett

T. (2013). Data Science for Business: What You Need to Know about Data Mining and Data-Analytic Thinking. O'Reilly Media. (Chapter 7

"Evaluating Models

" explains that in problems with imbalanced classes and high costs for false negatives

such as fraud detection or medical diagnosis

recall is a more critical metric than accuracy or precision).

3. Stanford University. (n.d.). CS229 - Machine Learning: Lecture Notes - Evaluation Metrics. (In discussions on skewed classes

these materials emphasize that when the cost of a false negative is high

such as in cancer detection

evaluating a model based on recall and precision is more informative than using accuracy. The same logic applies directly to critical equipment failure prediction).

The development and design of high-risk AI systems are fundamentally dependent on the data used for training, validation, and testing. Ensuring the availability of trustworthy data sets—which are relevant, representative, accurate, and free from inappropriate bias—is the most critical prerequisite. This foundational element directly impacts the model's performance, reliability, fairness, and safety. Without high-quality, trustworthy data, it is impossible to develop a high-risk AI system that is robust and aligned with its intended purpose, making this the most crucial support mechanism during the design phase.

A: Data backup is a critical operational control for business continuity and disaster recovery, not a primary input for the initial development and design of the AI model.

B: User training is an important organizational and governance control for data handling but does not directly support the technical process of designing and building the AI system.

D: Multi-factor authentication is an essential access control measure for securing the operational system, not a foundational component supporting the AI model's core design and development.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0).

Section 3.3.1

MAP 1: "Data is a critical component of many AI systems. Understanding the data’s characteristics and limitations is essential for mapping risks... This includes data quality

relevance

provenance

and potential for unwanted bias." This highlights that data understanding is a core part of the initial AI lifecycle stages.

2. European Commission. (2021). Proposal for a Regulation on a European approach for Artificial Intelligence (EU AI Act).

Article 10

"Data and data governance": This article specifies that for high-risk AI systems

"training

validation and testing data sets shall be subject to appropriate data governance and management practices." It mandates that data sets be "relevant

representative

free of errors and complete" to the greatest extent possible

establishing this as a core design requirement.

3. Floridi

L.

& Cowls

J. (2019). A Unified Framework of Five Principles for AI in Society. Harvard Data Science Review

1(1). https://doi.org/10.1162/99608f92.8cd550d1

The paper discusses the principle of "Beneficence

" which includes ensuring AI systems do not cause harm. It implicitly and explicitly links this to the quality and integrity of the data used to build them

stating

"The quality of the data used is paramount."

Data masking is the most effective preventative control because it addresses the root cause of potential information disclosure. This technique replaces sensitive data elements (e.g., names, social security numbers, credit card details) with realistic but non-sensitive, structurally equivalent placeholders before the data is used to train or fine-tune the LLM. By masking the data at the source, the model never learns or memorizes the actual sensitive information, making it impossible for it to disclose it later. This preserves the data's format and utility for training while eliminating the privacy risk.

A. Manual monitoring: This is a detective control, not a preventative one. It is also reactive and not scalable for the vast number of interactions an LLM chatbot handles.

B. Access controls: This limits who can interact with the LLM but does not prevent the LLM from disclosing sensitive information it has already learned to an authorized user.

C. Data sanitization: While correct, this is a broad category of which data masking is a specific, and often superior, technique. Data masking is more precise as it maintains data utility for training.

1. National Institute of Standards and Technology (NIST). (2010). NIST Special Publication 800-122: Guide to Protecting the Confidentiality of Personally Identifiable Information (PII). Section 5.3

"De-identification of PII

" discusses techniques like masking to reduce the sensitivity of data

which is a foundational principle for preparing data for use in systems like LLMs.

2. Carlini

N.

Tramer

F.

Wallace

E.

Jagielski

M.

Herbert-Voss

A.

Lee

K.

... & Raffel

C. (2021). Extracting Training Data from Large Language Models. In 30th USENIX Security Symposium (USENIX Security 21). This paper demonstrates that LLMs can memorize and regurgitate sensitive information from their training data

highlighting the critical need for preventative measures like masking to remove such data before training.

3. Stanford University

Center for Research on Foundation Models (CRFM). (2023). Report on the 2023 Workshop on Trustworthy ML: Robustness

Privacy

and Fairness. The report discusses privacy risks in foundation models

emphasizing the importance of data-centric mitigations. Section 3

"Privacy

" implicitly supports techniques like data masking by focusing on preventing the memorization of private training data.

The F1 score is the harmonic mean of precision and recall, designed to provide a single, balanced measure of a model's performance, especially when there is an uneven class distribution. An F1 score of 76% indicates the model's overall effectiveness in correctly identifying positive cases (i.e., "true maintenance needs") while accounting for both false positives (precision) and false negatives (recall). It is the most accurate summary of the model's predictive capability among the given options.

A: This misinterprets the 95% recall score. Recall means the model identifies 95% of all actual maintenance needs, not that 95% of its predictions are correct.

B: This incorrectly equates the model's accuracy metric (72%) with the physical operational uptime of the electrical grid, which are entirely different concepts.

C: This misinterprets the model's output horizon. The model makes predictions for a 90-day timeframe, it does not predict a failure at 90 days.

1. Ng

A. (n.d.). CS229 Machine Learning Course Notes: Part V - Learning Theory. Stanford University. In the section on "Precision/Recall

" the F1 score is defined as 2 (PR) / (P+R)

serving as a combined measure for precision (P) and recall (R) to evaluate a model's performance.

2. Powers

D. M. W. (2011). Evaluation: From Precision

Recall and F-Measure to ROC

Informedness

Markedness & Correlation. Journal of Machine Learning Technologies

2(1)

37-63. This paper details the F-measure (F1 score) as a harmonic mean of precision and recall

used as a summary metric for a model's ability to identify positive instances (p. 41).

3. Olson

D. L.

& Delen

D. (2008). Advanced Data Mining Techniques. Springer. Chapter 2

"Model Evaluation

" discusses the F1-score as a means to balance precision and recall into a single number that summarizes a model's effectiveness.

The primary and most fundamental purpose of an ethical review for an AI system is to assess its impact on people and society. This is most precisely captured by ensuring the system's operations align with the preservation of individual rights. Core ethical principles in AI, such as fairness, non-discrimination, privacy, and autonomy, are directly rooted in fundamental human and individual rights. While other aspects like performance and organizational alignment are important, they are often secondary to or derived from this core ethical mandate to "do no harm" and protect human dignity and rights.

A: Improving accuracy and performance is a primary goal of technical and operational reviews, not the central purpose of an ethical review.

B: Aligning with organizational values is a key governance activity, but these values should be grounded in the more fundamental and universal principle of preserving individual rights.

D: Identifying data drift is a technical model monitoring task. An ethical review is concerned with the impact of such drift on fairness and rights, not the technical phenomenon itself.

1. National Institute of Standards and Technology (NIST). (2023). AI Risk Management Framework (AI RMF 1.0). The framework's core is defined by seven characteristics of trustworthy AI

including "Fair - with harmful bias managed" and "Respectful of privacy

" which are directly tied to protecting individual rights. (See Section 3.2

"Characteristics of trustworthy AI systems

" pp. 12-13).

2. OECD. (2019). Recommendation of the Council on Artificial Intelligence. OECD/LEGAL/0449. The first two principles are "Inclusive growth

sustainable development and well-being" and "Human-centred values and fairness." The latter explicitly states that AI systems should be designed in a way that respects "the rule of law

human rights and democratic values." (See Section 1

Principles for responsible stewardship of trustworthy AI

pp. 4-5).

3. High-Level Expert Group on Artificial Intelligence

European Commission. (2019). Ethics Guidelines for Trustworthy Artificial Intelligence. The document states that Trustworthy AI has three components

one of which is that it should be "lawful

" which includes compliance with all applicable regulations

such as those concerning fundamental rights. The entire framework is built upon a "fundamental rights-based approach." (See Chapter I

"Foundations of Trustworthy AI

" p. 9).